A distributed denial-of-service (DDoS) attack is an attack in which multiple compromised computer systems attack a target, such as a server, website or other network resource, and cause a denial of service for users of the targeted resource. The flood of incoming messages, connection requests or malformed packets to the target system forces it to slow down or even crash and shut down, thereby denying service to legitimate users or systems.

Download this free guide

Your Guide to Info Sec Certifications

We’ve collected 30+ certifications for you. Which vendor-neutral and vendor-specific security certifications are best for you? Save time by downloading our list organized by experience level.

By submitting my Email address I confirm that I have read and accepted the Terms of Use and Declaration of Consent.

By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

DDoS attacks have been carried out by diverse threat actors, ranging from individual criminal hackers to organized crime rings and government agencies. In certain situations, often ones related to poor coding, missing patches or generally unstable systems, even legitimate requests to target systems can result in DDoS-like results.

How DDoS attacks work

In a typical DDoS attack, the assailant begins by exploiting a vulnerability in one computer system and making it the DDoS master. The attack master system identifies other vulnerable systems and gains control over them by either infecting the systems with malware or through bypassing the authentication controls (i.e., guessing the default password on a widely used system or device).

A computer or networked device under the control of an intruder is known as a zombie, or bot. The attacker creates what is called a command-and-control server to command the network of bots, also called a botnet. The person in control of a botnet is sometimes referred to as the botmaster (that term has also historically been used to refer to the first system "recruited" into a botnet because it is used to control the spread and activity of other systems in the botnet).

Botnets can be comprised of almost any number of bots; botnets with tens or hundreds of thousands of nodes have become increasingly common, and there may not be an upper limit to their size. Once the botnet is assembled, the attacker can use the traffic generated by the compromised devices to flood the target domain and knock it offline.

Types of DDoS attacks

There are three types of DDoS attacks. Network-centric or volumetric attacks overload a targeted resource by consuming available bandwidth with packet floods. Protocol attacks target network layer or transport layer protocols using flaws in the protocols to overwhelm targeted resources. And application layer attacks overload application services or databases with a high volume of application calls. The inundation of packets at the target causes a denial of service.

While it is clear that the target of a DDoS attack is a victim, there can be many other victims in a typical DDoS attack, including the owners of the systems used to execute the attack. Although the owners of infected computers are typically unaware their systems have been compromised, they are nevertheless likely to suffer a degradation of service during a DDoS attack.

Internet of things and DDoS attacks

While the things comprising the internet of things (IoT) may be useful to legitimate users, in some cases, they are even more helpful to DDoS attackers. The devices connected to IoT include any appliance into which some computing and networking capacity has been built, and, all too often, these devices are not designed with security in mind.

Devices connected to the IoT expose large attack surfaces and display minimal attention to security best practices. For example, devices are often shipped with hard-coded authentication credentials for system administration, making it simple for attackers to log in to the devices. In some cases, the authentication credentials cannot be changed. Devices also often ship without the capability to upgrade or patch device software, further exposing them to attacks that leverage well-known vulnerabilities.

Internet of things botnets are increasingly being used to wage massive DDoS attacks. In 2016, the Mirai botnet was used to attack the domain name service provider Dyn, based in Manchester, N.H.; attack volumes were measured at over 600 Gbps. Another late 2016 attack unleashed on OVH, the French hosting firm, peaked at more than 1 Tbps.

DDoS defense and prevention

DDoS attacks can create significant business risks with lasting effects. Therefore, it is important for IT and security administrators and managers, as well as their business executives, to understand the threats, vulnerabilities and risks associated with DDoS attacks.

Being on the receiving end of a DDoS attack is practically impossible to prevent. However, the business impact of these attacks can be minimized through some core information security practices, including performing ongoing security assessments to look for -- and resolve -- denial of service-related vulnerabilities and using network security controls, including services from cloud-based vendors specializing in responding to DDoS attacks.

In addition, solid patch management practices, email phishing testing and user awareness, and proactive network monitoring and alerting can help minimize an organization's contribution to DDoS attacks across the internet.

8 comments

Register

Login

Forgot your password?

Your password has been sent to:

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

Denial of service attack may not be distinguishable from real requests. Sometimes a spike in popularity of the web site causes the same effect as a malicious DDOS attack. In my 10 years of blogging a few times I indeed observed situations when rush of visitors made my blog serving 503s ("temporarily unavailable").

The software engineers who made Ufonet are simply evil people who are working for the American federalism. They made Ufonet intentionally buggy in order to work only on MACintosh platforms. It does not work on Linux nor on Windows. When one will try to install Python on MS-Windows the Python software will not setup a Path environment variable thus Ufonet will not work and there are no explanations about how to set it up correctly on MS-Windows. There are no distributions for the Linux operating system, there is only the source code. Because the federal police is behind it than it becomes the work of the devil and those who think are doing something good are instead becoming zombies. It is just a marketing trick to gain power with the federal police. Be aware of the bad dog!